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DETAILED ACTION 

1 . This communication is in response to the amendment filed on June 25, 
2004. 

2. Applicant's arguments with respect to claim 1-20 have been considered 
but are moot in view of the new ground(s) of rejection. 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 102 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

This application currently names joint inventors. In considering 
patentability of the claims under 35 U.S.C. 103(a), the examiner presumes that 
the subject matter of the various claims was commonly owned at the time any 
inventions covered therein were made absent any evidence to the contrary. 
Applicant is advised of the obligation under 37 CFR 1 .56 to point out the inventor 
and invention dates of each claim that was not commonly owned at the time a 
later invention was made in order for the examiner to consider the applicability of 
35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) prior art under 35 
U.S.C. 103(a). 
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4. Claims 1-20 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Kumar et al. ('Kumar' hereinafter), US Patent 6,697,810 in view of Walter 
Lindsay ('Lindsay' hereinafter), US Patent 6,694,338. 

With respect to claim 1 , 

Kumar discloses a method for analyzing database security (see Figs. 22 
and 33), said method comprising: 

connecting to one or more servers , wherein each server includes an 
instance, the instance including one or more databases (see col. 8, lines 24-34, 
Fig. 1); 

selecting one of the databases (see col. 12, lines 60-63); 

identifying a user id, wherein the user id has access to the selected 
databases (see col. 12, lines 60-63); 

retrieving a permitted user id list corresponding to the selected database 
(see col. 10, lines 1-10, Fig. 2 et seq); 

determining whether the user id is included in the permitted user id list 
(see col. 32, lines 55-65, Fig. 33); 

reporting the user id in response to the determining (see col. 19, lines 55- 
59, Fig. 19). 

Kumar does not explicitly indicate the claimed step of "instance". 
Lindsay discloses the claimed step of instance (see col. 2, lines 51-53). 
It would have been obvious to one ordinary skill in the data processing art, 
at the time of the invention to combine the teachings of the cited references, 
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because instance of Lindsay's teachings would have allowed Kumar system for 
document using meta-data associated with the first document by Lindsay, see 
col. 2, lines 4-5. 

As to claim 2, 

Kumar teaches retrieving a resolution corresponding to the determining 
(see col. 10, lines 1-10, Fig. 2 et seq); and including the resolution in the 
reporting (see col. 19, lines 55-59, Fig. 19). 

As to claim 3, 

Kumar teaches identifying a violation message type wherein the violation 
message type is selected from the group consisting of a removed users check, a 
DB files and logs access check, and a DB backup files and logs access check 
(see col. 19, lines 55-59, Figs. 19, 37, Abstract). 

As to claim 4, 

Kumar teaches wherein the database is selected from a group consisting 
of a database, a backup database, and a directory of databases (see col. 12, 
lines 60-63 et seq). 

As to claim 5, 

Kumar teaches wherein the connection is secure (see col. 8, lines 24-34, 
Figs. 1,22, 33). 

As to claim 6, 

Kumar teaches wherein the permitted user id list is selected from the 
group consisting of a database instance owner, a sysadm group, and a sysmaint 
group (see col. 19, lines 55-59, Fig. 27 and Abstract). 
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As to claim 7, 

Kumar teaches wherein the servers are on different operating platforms 
(see col. 32, 13-27 et seq). 

Claim 8 has same subject matter as of claim 1 except one or more 
processors; a memory accessible by the processors; one or more non-volatile 
storage devices accessible by the processors and Kumar discloses at col. 44, 
lines 32-34 and col. 38, lines 17-24, Fig. 37 et seq and essentially rejected for the 
same reasons as described above. 

Kumar does not explicitly indicate the claimed step of "instance". 

Lindsay discloses the claimed step of instance (see col. 2, lines 51-53). 

It would have been obvious to one ordinary skill in the data processing art, 
at the time of the invention to combine the teachings of the cited references, 
because instance of Lindsay's teachings would have allowed Kumar system for 
document using meta-data associated with the first document by Lindsay, see 
col. 2, lines 4-5. 

As to claim 9, 

Kumar teaches retrieving a resolution corresponding to the determining 
(see col. 10, lines 1-10, Fig. 2 et seq); and including the resolution in the 
reporting (see col. 19, lines 55-59, Fig. 19). 

As to claim 10, 

Kumar teaches identifying a violation message type wherein the violation 
message type is selected from the group consisting of a removed users check, a 
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DB files and logs access check, and a DB backup files and logs access check 
(see col. 19, lines 55-59, Figs. 19, 37 and Abstract). 
As to claim 1 1 , 

Kumar teaches wherein the database is selected from a group consisting 
of a database, a backup database, and a directory of databases (see col. 12, 
lines 60-63 et seq). 

As to claim 12, 

Kumar teaches wherein the permitted user id list is selected from the 
group consisting of a database instance owner, a sysadm group, and a sysmaint 
group (see col. 32, lines 55-65, Fig. 33). 

As to claim 13, 

Kumar teaches wherein the servers are on different operating platforms 
(see col. 32, 13-27 et seq). 

Claim 14 has same subject matter as of claim 1 and 8 except a computer 
program product stored in a computer operable media for analyzing database 
security, said computer program product (see Fig. 37 and col. 8, lines 25-35 and 
col. 38, lines 17-24 et seq and essentially rejected for the same reasons as 
described above. 

Kumar does not explicitly indicate the claimed step of "instance". 

Lindsay discloses the claimed step of instance (see col. 2, lines 51-53). 

It would have been obvious to one ordinary skill in the data processing art, 
at the time of the invention to combine the teachings of the cited references, 
because instance of Lindsay's teachings would have allowed Kumar system for 
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document using meta-data associated with the first document by Lindsay, see 
col. 1, lines 4-5. 

As to claim 15, 

Kumar teaches retrieving a resolution corresponding to the determining 
(see col. 10, lines 1-10, Fig. 2 et seq); and including the resolution in the 
reporting (see col. 19, lines 55-59, Fig. 19). 

As to claim 16, 

Kumar teaches identifying a violation message type wherein the violation 
message type is selected from the group consisting of a removed users check, a 
DB files and logs access check, and a DB backup files and logs access check 
(see col. 12, lines 60-63, Fig. 37 et seq). 

As to claim 17, 

Kumar teaches wherein the database is selected from a group consisting 
of a database, a backup database, and a directory of databases (see col. 12, 
lines 60-63). 

As to claim 18, 

Kumar teaches wherein the connection is secure (see col. 8, lines 24-34, 

Fig. 1). 

As to claim 19, 

Kumar teaches wherein the permitted user id list is selected from the 
group consisting of a database instance owner, a sysadm group, and a sysmaint 
group (see col. 32, lines 55-65, Fig. 33). 

As to claim 20, 
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Kumar teaches wherein the servers are on different operating platforms 
(see col. 32, 13-27 et seq). 
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Contact Informaiton 



5. Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Mohammad Ali whose telephone number is 
(571 ) 272-4105. The examiner can normally be reached on Monday to Thursday 
from 7:30am-6:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, John Breene can be reached on (571) 272-4107. The fax 
phone number for the organization where this application or proceeding is 
assigned is (703) 872-9306 for any communications. 

Any inquiry of a general nature or relating to the status of this application 
or proceeding should be directed to the receptionist whose telephone number is 
(703) 305-9600. 



Mohammad Ali 




MA 



October 27, 2004 



Primary Patent Examiner 
Art Unit: 2177 



